alloy vulnerabilities (SUSE)
66 vulnerabilities.
-
alloySUSE Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh 7.5 High -
alloySUSE Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh 7.5 High -
alloySUSE Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh 7.5 High -
alloySUSE grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X... 9.8 Critical -
alloySUSE Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite in the MongoDB Go Driver 7.1 High -
alloySUSE CVE-2026-75889 CVE Record 7.7 High -
alloySUSE go-git: Malicious reference names may modify files outside the reference storage 6.3 Medium -
alloySUSE go-git: Worktree operations may follow symlinks 7.1 High -
alloySUSE Infinite loop on invalid input in golang.org/x/text 7.5 High -
alloySUSE Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage 7.5 High -
alloySUSE opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent 6.2 Medium -
alloySUSE cilium ebpf LoadCollectionSpec/LoadCollectionSpecFromReader btf.go loadRawSpec integer overflow 4.8 Medium -
alloySUSE OpenTelemetry-Go's baggage parsing no longer caps raw header length 5.3 Medium -
alloySUSE Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html 6.1 Medium -
alloySUSE Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html 6.1 Medium -
alloySUSE Invoking duplicate attributes can cause XSS in golang.org/x/net/html 6.1 Medium -
alloySUSE Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html 6.1 Medium -
alloySUSE Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html 6.5 Medium -
alloySUSE Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent 5.3 Medium -
alloySUSE Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh 7.5 High -
alloySUSE Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh 10.0 Critical -
alloySUSE Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts 9.1 Critical -
alloySUSE Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh 5.3 Medium -
alloySUSE Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh 9.1 Critical -
alloySUSE Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent 9.1 Critical -
alloySUSE Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent 9.1 Critical -
alloySUSE Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh 9.1 Critical -
alloySUSE Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh 9.1 Critical -
alloySUSE Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh 7.5 High -
alloySUSE Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh 6.3 Medium -
alloySUSE Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh 6.5 Medium -
alloySUSE OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI 7.5 High -
alloySUSE OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages 7.5 High -
alloySUSE OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers 4.9 Medium -
alloySUSE OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals 5.1 Medium -
alloySUSE OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure 3.8 Low -
alloySUSE OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size 5.9 Medium -
alloySUSE OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU 5.9 Medium -
alloySUSE OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads 7.5 High -
alloySUSE OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages 6.5 Medium -
alloySUSE go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion 6.5 Medium -
alloySUSE Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net 7.5 High -
alloySUSE Apache Thrift: C++ JSON OOB read 6.5 Medium -
alloySUSE Apache Thrift: c_glib dispatch stack overflow 5.3 Medium -
alloySUSE Apache Thrift: Go TFramedTransport uint32 overflow 7.5 High -
alloySUSE pgx: SQL Injection via placeholder confusion with dollar quoted string literals 2.3 Low -
alloySUSE go-git Credential leak via cross-host redirect in smart HTTP transport 4.7 Medium -
alloySUSE Denial of service in the event stream header decoder in AWS SDK for Go v2 8.2 High -
alloySUSE Go JOSE affect by a panic in JWE decryption 7.5 High -
alloySUSE yaml is vulnerable to Stack Overflow via deeply nested YAML collections 4.3 Medium - Show olderLoading…